SCADA

Im not sure if this is the right fourm, or even if its legal, but does anyone know if it is possible to decode SCADA transmissions with an SDR dongle? Im just interested in listening to the data.

It should be legal (in the USA) as long as the details of the protocol are not kept secret by whoever designed it in order to prevent decoding, or the signal itself is not encrypted.

Ive been unable to locate anything that might be able to decode it. ive tried several things, nothing works. oh well.

kb0rpj said:

Im not sure if this is the right fourm, or even if its legal, but does anyone know if it is possible to decode SCADA transmissions with an SDR dongle? Im just interested in listening to the data.

Click to expand...

Even if you could decode it, it would appear meaningless.

After 911, the big blackout, and all the Homeland Security/NSA activity, I don't think I'd want to be caught monitoring it. They'd probably assume you were up to no good, trying to disrupt our infrastructure, and water board you!

Scada

No hes trying to see if he can decode it for pump or lift stations.

The data would be pretty meaning less to you. Most SCADA radios have propriatary modems in them...so really only the external signally between sensors and modem is standardized.

Well i actually know what it means..5 years in a water and sewer and dispatch setting.

Sent from my LGMS631 using Tapatalk

Back in the 80's the city of Wichita Falls used 2 watt data radios that ran AX.25 packet radio, the same format commonly used in ham radio.
I could copy it on my Kantronics KAM TNC but it was just a bunch of raw data with callsign headers. One time I save some of it to a file. Below is what it looked like.

The KAM header line format is
tx callsign>rx callsign/port: <frame type>:
/V = KAM 1200 baud VHF port
<UI> = Unnumbered Information

CTU>CQ/V: <UI>:
AIOII0008000000132000DENVER EST

RTUA>CQ/V: <UI>:
A000884F4E250101801BB60000DC3000000

CTU>CQ/V: <UI>:
BIIII00000000002F1000BURK PRES

CTU>CQ/V: <UI>:
CIIII0000000000178000HOLIDAY PRES

RTUC>CQ/V: <UI>:
C00003BB001007000000000000000000000

CTU>CQ/V: <UI>:
DIIII0000000000155000REILLY EST

RTUD>CQ/V: <UI>:
D00009A0000014000000000000000000000

CTU>CQ/V: <UI>:
EIIII0000000000147000PUCKETT EST

RTUE>CQ/V: <UI>:
E0000A1A000015000000000000000000000

CTU>CQ/V: <UI>:
FIIII000000000013C0009TH ST EST

RTUF>CQ/V: <UI>:
F0000A9600401D000000000000000000000

CTU>CQ/V: <UI>:
GIIII0000000000132000DENVER EST

CTU>CQ/V: <UI>:
HIIII0000000000115000EEXP EST

RTUH>CQ/V: <UI>:
H0000A1E004018000000000000000000000

CTU>CQ/V: <UI>:
IIOII0000000000115000EEXP EST

RTUI>CQ/V: <UI>:
I00007E956D001000000000000000000000

CTU>CQ/V: <UI>:
JIOII00220000001470E4PUCKETT EST LOCAL GST

RTUJ>CQ/V: <UI>:
J00228DB52C4C0000000000000000000000

At best you might decode some values but without knowing what the vales are asighed to or there span or unit of measure the information would be worthless at best. Looks like RTU's Radio Termanal Units and a SCADA Master Control Termanal Unit SCADA systems Ihave worked with would pull one addess at a time or they send out on acception or at preset times

Be a bunch of numbers and commands on SCADA...

Sent from my LGMS631 using Tapatalk